Moscowchannel.com hack

Not really crypto, but related to the DOJ hack in a way.

Moscow Channel is a pretty slick, Russian news/commentary page.  Their Web
site was hacked and altered by someone who didn't seem to like Russians all
that well.  See:

http://www.moscowchannel.com/

While not as elaborate as the DOJ hack, it's interesting that Web page
vandalism is starting to turn into a unique form of protest and social
commentary.

As Web sites with security holes increase, my guess is vandalism will
increase incrementally.  Both in terms of random graffiti, and targeted attacks.

Just a matter of time before some builds a dedicated Satan type tool that
scans for  HTTP server holes or messed up file permissions to make locating
potential victims easy.

Joel McNamara wrote:
> 
> Not really crypto, but related to the DOJ hack in a way.
> 
> Moscow Channel is a pretty slick, Russian news/commentary page.  Their Web
> site was hacked and altered by someone who didn't seem to like Russians all
> that well.  See:
> 
> http://www.moscowchannel.com/
> 
> While not as elaborate as the DOJ hack, it's interesting that Web page
> vandalism is starting to turn into a unique form of protest and social
> commentary.

At least they had more sense of humor than USDoJ and made the
hacked page available from their website. To compensate for lack
of humor at USDOJ, I made their page available at 

http://www.algebra.com/~ichudov 

(follow the links). A tarred archive is available from there for 
downloading.

	- Igor.

P.S. I am very surprised by huge number of hits to my usdoj page. I wonder
where are the links to my page.

On Sat, 31 Aug 1996, Joel McNamara wrote:

> Not really crypto, but related to the DOJ hack in a way.
> 
> Moscow Channel is a pretty slick, Russian news/commentary page.  Their Web
> site was hacked and altered by someone who didn't seem to like Russians all
> Just a matter of time before some builds a dedicated Satan type tool that
> scans for  HTTP server holes or messed up file permissions to make locating
> potential victims easy.


Write your web site to a CD-ROM and hard-code the base directory into the
webserver.


Petro, Christopher C.
petro@suba.com <prefered for any non-list stuff>
snow@smoke.suba.com

snow wrote:
> 
> On Sat, 31 Aug 1996, Joel McNamara wrote:
> 
> > Not really crypto, but related to the DOJ hack in a way.
> > 
> > Moscow Channel is a pretty slick, Russian news/commentary page.  Their Web
> > site was hacked and altered by someone who didn't seem to like Russians all
> > Just a matter of time before some builds a dedicated Satan type tool that
> > scans for  HTTP server holes or messed up file permissions to make locating
> > potential victims easy.
> Write your web site to a CD-ROM and hard-code the base directory into the
> webserver.

A hacker who has root can forcibly unmount the cdrom and mount another
directory on that node. Not a good solution.

	- Igor.

Igor Chudov @ home sez:
> 
> > Write your web site to a CD-ROM and hard-code the base directory into the
> > webserver.
> 
> A hacker who has root can forcibly unmount the cdrom and mount another
> directory on that node. Not a good solution.

Real hard disks such as RL02's & RK07's have WRITE DISABLE
switches....


-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433

David Lesher wrote:
> 
> Igor Chudov @ home sez:
> > 
> > > Write your web site to a CD-ROM and hard-code the base directory into the
> > > webserver.
> > 
> > A hacker who has root can forcibly unmount the cdrom and mount another
> > directory on that node. Not a good solution.
> 
> Real hard disks such as RL02's & RK07's have WRITE DISABLE
> switches....
> 

You can't mount the whole Unix read-only, so there will always be a place
to put the hacked web page, and then mount that place over DocumentRoot.

	- Igor.

-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 1 Sep 1996, Igor Chudov @ home wrote:

> snow wrote:
> > 
> > On Sat, 31 Aug 1996, Joel McNamara wrote:
> > 
> > > Not really crypto, but related to the DOJ hack in a way.
> > > 
> > > Moscow Channel is a pretty slick, Russian news/commentary page.  Their Web
> > > site was hacked and altered by someone who didn't seem to like Russians all
> > > Just a matter of time before some builds a dedicated Satan type tool that
> > > scans for  HTTP server holes or messed up file permissions to make locating
> > > potential victims easy.
> > Write your web site to a CD-ROM and hard-code the base directory into the
> > webserver.
> 
> A hacker who has root can forcibly unmount the cdrom and mount another
> directory on that node. Not a good solution.

As soon as the sysadmin finds out, said directory can be unmounted and CD-ROM
device can be remounted.  Besides, if someone manages to get root access on any
machine, the sysadmin of that machine is basically screwed anyway.  It's much
better than having to back up the web page on a tape and having to restore the
data when it is altered.

- -- Mark

PGP encrypted mail prefered.
Key fingerprint = d61734f2800486ae6f79bfeb70f95348
http://www.voicenet.com/~markm/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQEVAwUBMinT7yzIPc7jvyFpAQHe7AgAuRNtTXZeLkuXo0CFoJOgrI+EEfHOKUsI
9KoRm+aesqNOvFpxPcHiE2QypMDjgjFqGozsT+Qb48W82Yt0p10PdqGtq1Ais+M0
b8gwLbnUPY8tnRFL49TqZIvAHl2kyo/7pxViTrXfNtBe+rSA+9FZHPBJgtHzWy2X
LIOQ9P6NPMmdlKuaeZQ3oF1esbvlHInsYOgGTJN0DZQR8ivFyXZ3MA0XjXvnF2pl
4lUDfgUN+BAQzhW56o0cgBnGYetujNJYVAQkzUwCIs2sfxS1Sex305vqfmFHUVkY
HACMhuoVXYZXuF+5NCjfhHsnjEiYgeMczGTZDlwOCbIFTxCc8/t6tQ==
=oxki
-----END PGP SIGNATURE-----

Mark M. wrote:
> > A hacker who has root can forcibly unmount the cdrom and mount another
> > directory on that node. Not a good solution.
> 
> As soon as the sysadmin finds out, said directory can be unmounted and CD-ROM
> device can be remounted.  Besides, if someone manages to get root access on any
> machine, the sysadmin of that machine is basically screwed anyway.  It's much
> better than having to back up the web page on a tape and having to restore the
> data when it is altered.

It depends on the ratio 

   R = (frequency of legit Web page changes) / (frequency of breakins 
                                                * cost of a breakin).

The lower is R, the more what you say makes sense. I suspect that 
in the real world R is rather high.

	- Igor.